Penetration testing is an authorized simulated attack. A client hires a tester to break into their systems, networks, or applications. The tester uses the same techniques as a real attacker: reconnaissance, exploitation, privilege escalation, and lateral movement. The difference is permission and documentation. Everything happens within a defined scope, with rules of engagement and a signed contract. At the end, the client gets a report detailing what was found and how to fix it.

Tests come in different flavors. Black-box testing gives the tester no prior knowledge, mimicking an external attacker. White-box testing provides full access to source code and architecture, which finds deeper flaws. Grey-box sits in between. Web application tests focus on SQL injection, cross-site scripting, and authentication flaws. Network tests probe firewalls, segmentation, and exposed services. Social engineering tests target people with phishing and pretexting. A penetration test is a snapshot. It finds what is exploitable at a point in time. It does not replace continuous monitoring or secure development. It validates that the defenses work, or shows where they do not.

Penetration testing types

• Black-box — no prior knowledge, external perspective
• White-box — full access, deeper coverage
• Grey-box — partial knowledge, realistic balance
• Web application — focuses on web-facing software
• Social engineering — targets people, not systems

A penetration test without remediation is a waste of money. The report matters only if someone acts on it.